BaseFortify

Executive Summary

LibreChat version 0.7.9 has a vulnerability in its /api/memories endpoint where the 'key' and 'value' parameters accept arbitrarily large inputs without proper validation. This causes a null pointer error in the Rust backend when excessively large values are submitted, leading to a Denial of Service (DoS) attack by preventing the creation of new memories and impacting service stability.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a Denial of Service (DoS) by crashing or destabilizing the LibreChat service when large inputs are submitted to the /api/memories endpoint. As a result, users may be unable to create new memories, leading to degraded service availability and reliability.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by monitoring requests to the `/api/memories` endpoint for unusually large payloads or excessively long `key` or `value` parameters. For example, using command-line tools like curl or network monitoring tools, you can check for POST or PATCH requests with payload sizes exceeding 100KB or keys longer than 1000 characters and values longer than 10,000 characters. A sample curl command to test might be: `curl -X POST https://yourlibrechatinstance/api/memories -H 'Content-Type: application/json' -d '{"key":"<very_long_key>", "value":"<very_long_value>"}'` and observe if the server returns a 400 error indicating payload size or length violations. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include applying the update that enforces strict payload size limits and validation on the `/api/memories` endpoint. This involves limiting JSON payloads to 100KB, restricting memory keys to a maximum of 1000 characters, and memory values to a configurable limit (default 10,000 characters). Additionally, token count checks should be enabled to reject requests exceeding token limits. If you cannot update immediately, consider implementing network-level controls to block or rate-limit requests with excessively large payloads to the `/api/memories` endpoint. [1]

Useful 0 Not Useful 0